MEMORANDUM CIRCULAR NO. 001-12-2022
WHEREAS, Executive Order No. 546 series of 1979 (EO 546) created the National Telecommunications Commission (NTC) with mandate, among others, to supervise and regulate public telecommunications network and services; WHEREAS, Republic Act No. 7925 (RA 7925), otherwise known as the "Public Telecommunications Policy Act" likewise recognizes the essential role of telecommunication in economic development, integrity and security of the Philippines, and as such shall be developed and administered as to safeguard, enrich and strengthen the economic, cultural, social and political fabric of the Philippines; WHEREAS, under Section 12 of Republic Act No. 11934 (RA 11934), otherwise known as the "Subscriber Identity Module (SIM) Registration Act", the NTC, in coordination with other concerned agencies such as, but not limited to the Department of Information and Communications Technology (DICT), Department of Trade and Industry (DTI), National Privacy Commission (NPC), as well as Public Telecommunications Entities (PTEs) and major consumer groups, shall set the guidelines for the monitoring and proper implementation of the said Act and shall promulgate the implementing rules and regulations as may be necessary to ensure the effective implementation of said Act; NOW, THEREFORE, pursuant to EO 546, RA 7925 and RA 11934, the following rules and regulations are hereby promulgated:
Act refers to Republic Act No. 11934, otherwise known as Subscriber Identity Module (SIM) Registration Act.
Automatic deactivation refers to the automated process of rendering a SIM incapable of being used for outgoing and incoming calls, internet access, or sending and receiving messages, upon the expiration of the period for registration set forth under the Act and this IRR.
Barring or temporarily deactivating a SIM refers to the blocking of the SIM rendering it unusable for all incoming or outgoing calls and short messaging service (SMS) or any mobile data services without permanently deactivating the SIM.
Consent refers to any freely given, specific, informed, indication of will whereby the subscriber/end-user agrees to the processing of personal data about and/or relating to him or her. Consent shall be evidenced by written, electronic, or recorded means. It may also be given on behalf of the subscriber/end-user by an agent specifically authorized by the subscriber/end-user to do so.
Competent Authority refers to such law enforcement agencies, cybercrime prevention bodies, or prosecutorial offices, with subpoena powers, as established or created by laws, and relevant orders, rules, circulars and regulations.
Deactivated state refers to the condition or status of a SIM rendering it incapable of being used for outgoing and incoming calls, internet access, or sending and receiving messages, except for exclusively enabling and informing such SIM to be registered.
End-user refers to any existing subscriber; and/or any individual or juridical entity which purchases a SIM from the PTEs, its agents, resellers, or any entity.
Persons of Concern or POC refer to refugees, asylum seekers, stateless persons, stateless applicants, and populations at risk of statelessness as defined and covered under the 1951 Convention Relating to the Status of Refugees and its 1967 Protocol, and the 1954 Convention Relating to the Status of Stateless Persons and the 1961 Convention on the Reduction of Statelessness.
Postpaid subscription refers to the subscription wherein service is provided by virtue of a prior arrangement with a public telecommunications entity, and the end-user thereof is billed at the end of the monthly billing cycle according to the use of mobile service.
Prepaid subscription refers to the subscription wherein credit is purchased in advance of service use. The purchased credit is used to pay for mobile phone services at the point the service is accessed or consumed. If there is no available credit, then access to the requested service is denied.
Public Telecommunications Entity or PTE refers to any person, natural or juridical, government or private, engaged in the provision of telecommunications services to the public for compensation, as defined under Republic Act No. 7925, as amended, or the Public Telecommunications Policy Act of the Philippines.
Purchase of SIM refers to the acquisition of a SIM by an end-user whether for consideration or otherwise including through sale, barter, donation or other means.
Reseller refers to a person, natural or juridical, who dispenses or sells a SIM to an end-user.
Serial Number refers to a unique PTE-generated registration reference or tracking number. This number is automatically generated in the SIM registration platform upon registration of the SIM by the end-user.
SIM refers to the Subscriber Identity Module which is an embedded circuit that securely stores International Mobile Subscriber Identity (IMSI) and related keys or an electronic equivalent thereof, used to identify and authenticate subscribers on mobile devices, such as mobile phones and computers, and other electronic devices. For purposes of the Act and this IRR, this shall include e-SIMs and other variations thereof.
SIM Register refers to the secure digital database containing the required information under Section 5 of the Act, for registered postpaid and prepaid subscribers or end-users, whether commingled or kept separately in a secure physical or virtual location under the control of the PTE.
Spoofing refers to the act of transmitting misleading or inaccurate information about the source of the phone call or text message, with the intent to defraud, cause harm, or wrongfully obtain anything of value.
In order to regulate the registration and use of SIMs, all end-users shall be required to register their SIMs with their respective PTEs as a pre-requisite to the activation thereof. All covered SIMs, including embedded SIMs (eSIMs), other variations/technologies and other future technologies thereof, which are provisioned by any PTE to provide SMS, voice, and/or data services are subject for registration. These include SIMs intended for data-only or used for fixed wireless broadband modem and/or wireless local loop, machine-to-machine (M2M) service and/or Internet of Things (IoT).
An end-user who fails to comply with the requirements for registration shall result in their SIM not being activated.
All the SIMs to be sold and/or issued by the PTEs, its agents, resellers, or any entity shall be in a deactivated state as defined in Rule 1 Section 3(f) of this IRR. It shall only be activated after the end-user completes the process of registration.
The SIMs that are registered for foreign national end-users visiting as tourists under Section 9(a) of Commonwealth Act No. 613, as amended, shall only be valid temporarily for thirty (30) days, and shall automatically be deactivated upon expiration of the validity of the SIM. The validity of such SIM may be extended only upon presentation or submission by the said foreign national of an approved visa extension.
Foreign nationals with other types of visas can acquire SIMs without the thirty (30)-day temporary validity period, and register the same following the respective PTE’s registration process.
The relevant government agencies, such as but not limited to the DICT, NTC, Department of the Interior and Local Government (DILG), and Department of Education (DepEd); and concerned PTEs shall facilitate all SIM registrations in remote areas with limited telecommunication or internet access. The DICT and NTC shall initiate the necessary coordination in such facilitation efforts. The registration facilities in remote areas shall be established within sixty (60) days from the effectivity of the Act.
SIM registration shall be implemented at no cost to the end-users.
All existing SIM subscribers/end-users shall register within one hundred eighty (180) days from effectivity of the Act. The registration may be extended for a period not exceeding one hundred twenty (120) days. Failure to register the existing SIM within the period prescribed shall result in the automatic deactivation of the SIM. The deactivated SIM may only be reactivated after registration; provided, however, that reactivation shall be made not later than five (5) days after such automatic deactivation.
PTEs shall include the information and data of existing postpaid subscribers in the SIM register to align with the registration requirement hereunder. To complete registration however, such existing postpaid subscribers shall be required to confirm their information and data included in the SIM Register, through the PTE’s registration platform or website established under the Act and this IRR.
The Registration Form shall be accomplished electronically through a secure platform or website to be provided by the PTEs to their respective subscribers. The same shall include a declaration by the end-user that the identification documents presented are true and correct, and that said person is the one who accomplished the registration form.
The platform or website to be used for the registration as well as the registration form shall give due consideration on the user interface, user experience, and accessibility. The registration portal shall be easy to use and navigate, considering the needs of various end-users.
A privacy notice shall be made available on the platform or website. It shall explain the details of the processing of personal data for the SIM Register.
The registration process shall be guided by the following parameters:
Submission of the electronically and duly accomplished registration form with the following data and information only: By individual (natural person) end-user: (1) Full Name; (2) Date of Birth; (3) Sex; (4) Present/Official Address (Choice by end-user); (5) Type of ID Presented; and (6) ID Number Presented. By juridical entity end-user: (1) Business Name; (2) Business Address; and (3) Full Name of Authorized Signatory. By foreign national end-user: (1) Full Name; (2) Nationality; (3) Date of Birth; (4) Passport; (5) Address in the Philippines; (6) For Persons of Concern or POCs, the Type of Travel or Admission Document Presented; and (7) ID Number or Number of Document Presented. (ii) Presentation of valid government-issued identification (ID) card or other similar form of document with photo. (iii) Inputting of the assigned mobile number of the SIM with its serial number.
The PTEs shall be enjoined to include processes to verify the submitted information and data, subject to the applicable provisions of the Data Privacy Act, its IRR, and other relevant issuances of the National Privacy Commission.
For individual end-user, ANY of the following identification cards or documents with photo shall be presented: (i) Passport; (ii) Philippine Identification System ID, or the Philippine Identification Card; (iii) Social Security Service ID; (iv) Government Service Insurance System e-Card; (v) Driver’s License; (vi) National Bureau of Investigation clearance; (vii) Police clearance; (viii) Firearms’ License to Own and Possess ID; (ix) Professional Regulation Commission ID; (x) Integrated Bar of the Philippines ID; (xi) Overseas Workers Welfare Administration ID; (xii) Bureau of Internal Revenue ID; (xiii) Voter’s ID; (xiv) Senior Citizen’s card; (xv) Unified Multi-purpose Identification Card; (xvi) Persons with Disabilities card; or (xvii) Other valid government-issued ID with photo.
For juridical entity end-user, ALL of the following shall be presented: (i) Certificate of Registration; and (ii) In the case of corporations, duly adopted resolution designating the authorized representative, and in the case of other juridical entities, a special power of attorney.
For minor end-user, the registration of a SIM shall be under the name of the minor's parent or guardian and ALL of the following shall be presented: (i) ANY of the identification (ID) cards identified in Section 7(a) of this IRR; and (ii) Consent of the minor’s parent or guardian, to register the SIM.
For foreign national end-user visiting as tourists under Section 9(a) of Commonwealth Act No. 613, as amended, ALL of the following shall be presented: (i) Passport (i.e., copy of the bio-page and pages where the current 9(a) visa is stamped or shown); (ii) Proof of address in the Philippines (i.e., booking in a hotel or other type of accommodation, or in the absence thereof, an affidavit/letter from the owner of the house or residence where such foreign national will stay); and (iii) Return ticket to own country of the tourist or any other ticket showing the date and time of departure from the Philippines.
For foreign national end-user with other types of visas, ALL of the following shall be presented: (i) Passport (i.e., copy of the bio-page and pages where the type of visa is stamped or shown); (ii) Proof of address in the Philippines (i.e., booking in a hotel or other type of accommodation, or in the absence thereof, an affidavit/letter from the owner of the house or residence or contract of lease of residence/space where such foreign national will stay); and (iii) Other pertinent document, whichever is applicable: (1) Alien Employment Permit issued by the Department of Labor and Employment (DOLE); (2) Alien Certificate of Registration Identification Card (ACRI Card) issued by the Bureau of Immigration (BI) or other types of official ID issued by any other visa-issuing agency; (3) School registration and ID for students; or (4) For Persons of Concern or POCs, the type of travel or admission document validly issued by the Department of Justice.
All PTEs shall maintain their own database containing information required under the Act. The database shall strictly serve as a SIM Register to be used by PTEs to process, activate or deactivate a SIM or subscription and shall not be used for any other purpose, unless otherwise provided under the Act.
The successful submission and acceptance of the required registration form shall serve as the certification of registration by the end-user.
Undertake registration of their own SIMs within one hundred eighty (180) days from the effectivity of the Act, without prejudice to the possible extension by the DICT up to a maximum period of one hundred twenty (120) days, as provided under the Act.
Immediately report to their respective PTEs: (1) any change in the information supplied in their applications for SIM registration; (2) lost or stolen SIM by providing the following information: (i) Name; (ii) Address; (iii) Date of Birth; (iv) Mobile Subscriber Number; and (v) Such other relevant and reasonable information as may be required by the PTE to fully establish ownership of the SIM.
In case of death of the end-user, the immediate family or relatives shall immediately report said information to the respective PTE.
Submit to their respective PTEs any request for SIM activation/deactivation.
Undertake not to sell or transfer registered SIMs without complying with the registration requirements under the Act and this IRR.
Establish their own secure online SIM registration platform. The online registration platform shall be user-friendly and easy to use for the benefit of the registering subscribers/end-users. PTEs shall also provide additional means to assist persons with disabilities, senior citizens, pregnant women, and/or persons with special needs in registering their respective SIMs. PTEs shall be enjoined to also include procedures to verify the data and information submitted and presented by the registering subscribers/end-users.
Maintain a register of the SIMs of their respective end-users and include the data of existing postpaid subscribers in the SIM register.
Send notice of successful submission and acceptance of registration form to the end-users on the same day.
Effect any change in the information in their respective SIM registers requested by their respective end-users within two (2) hours from receipt of such requests.
Deactivate the SIM within twenty-four (24) hours from receipt of information on the death of the end-user, loss or theft of a SIM, or request for deactivation.
Immediately effect barring of any SIM reported as lost or stolen thereby rendering it unusable for any incoming or outgoing text, call and use of mobile data service. Such SIM will be permanently deactivated upon issuance of a new SIM to the verified end-user or within twenty-four (24) hours as provided under Section 10(e) of this IRR, whichever comes earlier.
Deactivate, temporarily or permanently, the SIM used for fraudulent text or call, upon due investigation.
Deactivate all prepaid SIMs for sale to the public upon the effectivity of the Act. Otherwise, the concerned PTE shall be liable for the penalties prescribed under the Act.
Retain for ten (10) years from date of deactivation the relevant data and information of any deactivated SIM.
Treat as absolutely confidential and not to disclose to any person any information and data obtained in the registration process.
Provide user-friendly reporting mechanism for their respective end-users to report any potentially fraudulent text or call, change of information, lost or stolen SIM, or death of a registered end-user.
Ensure that the end-users’ data are secured, encrypted and protected at all times and comply with the minimum information security standards prescribed by the DICT consistent with internationally-accepted cybersecurity standards and relevant laws, rules and regulations.
Report to the DICT, within twenty-four (24) hours of detection, any incident of cyber-attack on the SIM register. In the event that the cyber-attack should also result in personal data breach, PTEs shall comply with the personal data breach notifications and other reportorial requirements pursuant to the provisions of the Data Privacy Act of 2012 (DPA) and applicable issuances of the National Privacy Commission (NPC).
Allow DICT to perform an annual audit on the PTEs’ compliance with information security standards.
Submit to the NTC, DICT, and both Houses of Congress, on or before the 30th day of April of each year, an annual report on the implementation of the provisions of the Act and this IRR for the previous calendar year.
Facilitate, together with the relevant government agencies, the SIM registration process in remote areas with limited telecommunications or internet access.
Comply, at all times, with the requirements of the DPA of 2012 and issuances of the NPC such as, among others: (i) Conduct of mandatory privacy impact assessment on the respective SIM Registers prior to the entry of any personal data in the Registers, or within a reasonable time thereafter. (iii) Implementation of reasonable and appropriate physical, organizational, and technical security measures to protect personal data of data subjects throughout the data lifecycle of the SIM Register. (iv) Enable mechanisms for the exercise of the rights of end-users as data subjects under the DPA of 2012. (v) Ensure that any processing of personal data submitted by the end-user in the registration of their SIM shall have a legitimate purpose which is not contrary to law, morals, public order, and public policy, and meets the criteria for lawful processing of personal data under the DPA.
Notwithstanding this provision, the PTE shall disclose the full name and address of an end-user in the following instances:
In compliance with any law obligating the PTE to disclose such information in accordance with the provisions of Republic Act No. 10173 or the Data Privacy Act of 2012;
In compliance with a court order or legal process upon finding of probable cause;
In compliance with Section 10 of the Act and Section 12 of this IRR; or
With the written consent of the subscriber: Such waiver of absolute confidentiality shall not be made as a condition for the approval of subscription agreements with the PTEs. The confidentiality clause in the SIM registration shall take effect at the point of activation and shall continue even after deactivation of the SIM and for as long as the end-user's data is still retained by the PTEs. For this purpose, the point of activation shall mean the time when the concerned PTE receives the required data or information from the registering subscriber/end-user.
No PTE shall be held administratively, civilly, or criminally liable on account of any disclosure done in compliance with the Act. The relevant data and information shall be kept by the PTEs for a period of ten (10) years from the time a particular subscriber/end-user’s mobile number is deactivated, and solely for the purpose discussed under Section 10 of the Act.
The following penalties shall be imposed for violation of any provision of the Act:
First offense: a fine of not less than one hundred thousand pesos (P100,000.00) but not more than three hundred thousand pesos (P300,000.00);
Second offense: a fine of not less than three hundred thousand pesos (P300,000.00) but not more than five hundred thousand pesos (P500,000.00); and
Third and subsequent offenses: a fine of not less than five hundred thousand pesos (₱500,000.00) but not more than one million pesos (₱1,000,000.00) for every offense thereof.
If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime.
Done this 12th day of December 2022 in Quezon City, Philippines.